do_tls_setsockopt_tx_payload_len() refuses to resize records while one is open, but reaches for the open record through tls_sw_ctx_tx(), an unchecked cast of ctx->priv_ctx_tx. Under device offload that pointer is a tls_offload_context_tx, so the check reads a field of the wrong struct: it returns EBUSY on whatever happens to be there, and never sees the record that really is open, which lets the limit be lowered mid-record. Dispatch on tx_conf. Offload was in scope from the start, the same commit taught tls_push_data() to honour tx_max_payload_len. Fixes: 82cb5be6ad64 ("net/tls: support setting the maximum payload size") Signed-off-by: Jiayuan Chen --- base on my netdevsim + tls (in progress) https://lore.kernel.org/netdev/20260728125658.390500-1-jiayuan.chen@linux.dev/ Previous finding: b17cf742eaad ("tls: device: fix out-of-bounds write in tls_append_frag()") --- net/tls/tls_main.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index fbb274287aa5..e4f288c1fa34 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -833,15 +833,29 @@ static int do_tls_setsockopt_no_pad(struct sock *sk, sockptr_t optval, return rc; } +/* priv_ctx_tx holds a different structure on each TX path, so tx_conf has to + * say which open record to look at. + */ +static bool tls_tx_record_is_open(struct tls_context *ctx) +{ + switch (ctx->tx_conf) { + case TLS_SW: + return !!tls_sw_ctx_tx(ctx)->open_rec; + case TLS_HW: + return !!tls_offload_ctx_tx(ctx)->open_record; + default: + return false; + } +} + static int do_tls_setsockopt_tx_payload_len(struct sock *sk, sockptr_t optval, unsigned int optlen) { struct tls_context *ctx = tls_get_ctx(sk); - struct tls_sw_context_tx *sw_ctx = tls_sw_ctx_tx(ctx); u16 value; bool tls_13 = ctx->prot_info.version == TLS_1_3_VERSION; - if (sw_ctx && sw_ctx->open_rec) + if (tls_tx_record_is_open(ctx)) return -EBUSY; if (sockptr_is_null(optval) || optlen != sizeof(value)) -- 2.43.0